Problem identifying users in our intranet vs outside our network for timeclock program

Background--first time poster:

I am a programmer(20+ years on IBM midrange computers using RPGLE) and have developed a "Time Clock" program for the Coke/Beer distribution company I work for. This program allows users to clock in and out, print timecards, and edit timecards (based on security set by extended attributes associated with the users profile). It was written using Modx, php, html, ajax, and javascript. (I know, somewhat redundant )

User profiles are utilized for log in, using a modified log in program. The (visual) clock is jdigiclock. This program is to be used in 13 locations across 5 states on ipads, iphones, windows mobile, windows, and thin clients to feed GP hours via a generated spreadsheet.

Problem:
My boss wants to run this program with a switch that will allow certain users to clock in from anywhere, but also limit certain other users to only be able to clock in from designated timeclocks at specific computers on site at each of the 13 locations.

I had thought to use the IP address of the client to make such a determination, but had no luck with it. Part of the time users are hitting a proxy server which masks their ip address.

I am open to any suggestions.

If the IP won't do it, I think your only option is to let them identify themselves and try to clock in, then reject those who don't qualify.

Quote from: BobRay at Jan 03, 2014, 02:19 PM

If the IP won't do it, I think your only option is to let them identify themselves and try to clock in, then reject those who don't qualify.

Bob,

Thanks for your quick response. I know everyone is busy this time of the year with year-ends, holidays, etc...

The purpose here is to ensure someone is actually, physically in the building at the required time. Our salesmen who do not come in to the office every day would need to be able to clock in on their phone or laptop, but the warehouse and office personnel would need to use the timeclock in their respective building to clock in and out. Would there be a way to identify the machine that they are clocking in on (Other than the IP address)? I know I can copy the program and have a link for the "local" timeclock with no security attribute check for logging in and out, then have my sales force that do not come in call a different version that checks the user attributes to ensure that those are allowed to clock in from outside. The problem there is that if the warehouse/office personnel are smart enough, they just use the other link at home, in the car... Each user has to identify themselves when they log in by their Modx login ID, so I know who they are. I just do not know where they are. I had thought of even retrieving the MAC address of the client, but was not sure I could get that using PHP or Java from the server side.

Also, after reading my post, I would add that this is not a major problem for us, only a problem with certain people who always seem to try to "game" the system, sometimes only to prove that they can.

Your LANs are probably using one of the private address blocks http://en.wikipedia.org/wiki/Private_network so anybody not using such an IP address is coming in from outside of your local network, proxy or no. If a user belonging to the "localOnly" group has logged in from any other IP address block, abort the login.

If you really wanted to know where the user was, then you'd have a problem, but since all you want to know is that he is/is not on the LAN, the IP block he's using, whether it's one of the private IP blocks or not, should be all you need.

Quote from: sottwell at Jan 03, 2014, 11:21 PM

Your LANs are probably using one of the private address blocks http://en.wikipedia.org/wiki/Private_network so anybody not using such an IP address is coming in from outside of your local network, proxy or no. If a user belonging to the "localOnly" group has logged in from any other IP address block, abort the login.

If you really wanted to know where the user was, then you'd have a problem, but since all you want to know is that he is/is not on the LAN, the IP block he's using, whether it's one of the private IP blocks or not, should be all you need.

Thanks for the response.

Each different location had a router with 1 192.168.xx.1 address. I have tried doing as you suggested, and within our physical location it works fine. However, when I go out to one of our off site locations, I get something other than a 192.168.xx.xxx.

Well, you would have to. You cannot use one of those addresses to connect through the live Internet. However, I would presume that each of the offsite locations has its own dedicated IP address (or block), so you can know when someone is coming in from one of those locations.

Quote from: sottwell at Jan 13, 2014, 07:50 PM

Well, you would have to. You cannot use one of those addresses to connect through the live Internet. However, I would presume that each of the offsite locations has its own dedicated IP address (or block), so you can know when someone is coming in from one of those locations.

Well, I decided to use HTML5 and local storage to try to solve my problem. I do not know if it is going to work for everything, but it is working in my office. More testing to follow.

The code I am using(on a chunk called after the user logs on) follows. The Allow_Internal_External is a snippet that retrieves an extended attribute telling the user that they can or cannot log in away from a "designated" timeclock device. The timeclock device is "designated" as such by writing a matched pair to It's localStorage using localStorage.setItem('Timeclock',some Value):
<script>
function CheckTimeclock() {
var mod1 = 'test'; // pair name pair Value
mod1=localStorage.getItem('Timeclock','Timeclock');
var x = '[[!Allow_Internal_External?]]';
// If user can only log in on a designated timeclock
if(!(x=="Y")) {
//If not a designated timeclock
if(!(mod1=='Timeclock')) {
window.location.href = 'https://www.your site/index.php?id=32';
}
}

return;
}
function addLoadEvent(func) {
var oldonload = window.onload;
if (typeof window.onload != 'function') {
window.onload = func;
} else {
window.onload = function() {
if (oldonload) {
oldonload();
}
func();
}
}
}

addLoadEvent(CheckTimeclock);
addLoadEvent(redirectionTimer);
addLoadEvent(function() {
document.body.style.backgroundColor = '#EFDF95';
})


</script>

Thanks to all for your insights. [ed. note: cdurbin last edited this post 12 years, 9 months ago.]